github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution] Fix code scanning alert no. 469: Prototype-polluting function (#201712)

Browse source 
Fixes
[https://github.com/elastic/kibana/security/code-scanning/469](https://github.com/elastic/kibana/security/code-scanning/469)

While I don't think this is actually an issue, as source is only a set
of ecs fields that ultimately are defined in the code and not controlled
by the user
https://github.com/elastic/kibana/blob/main/packages/kbn-alerts-as-data-utils/src/search/security/fields.ts#L47
This suggested fix doesn't have any negative impact/makes it future
proof if ever used elsewhere.

To fix the prototype pollution issue in the `deepMerge` function, we
need to ensure that the function does not copy the special properties
`__proto__` and `constructor`. Additionally, we should verify that the
properties being copied are own properties of the `source` object. This
can be achieved by adding checks within the `deepMerge` function.


_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Kevin Qualters 2024-11-27 16:56:59 -05:00 • committed by GitHub
parent 318dacc2f5
commit bcbf85a71f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/format_timeline_data.ts
View file

@ -34,7 +34,14 @@ const createBaseTimelineEdges = (): TimelineEdges => ({
function deepMerge(target: EventSource, source: EventSource) {
for (const key in source) {
if (source && source[key] instanceof Object && target && target[key] instanceof Object) {
if (
!Object.prototype.hasOwnProperty.call(source, key) ||
key === '__proto__' ||
key === 'constructor'
)
// eslint-disable-next-line no-continue
continue;
if (source[key] instanceof Object && target[key] instanceof Object) {
deepMerge(target[key], source[key]);
} else {
target[key] = source[key];